Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-11-2024 10:27
Behavioral task
behavioral1
Sample
7971881855b6c6c2ac99fc9ac82def577ee578345d4f24e043e9415661bbc799.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
General
-
Target
7971881855b6c6c2ac99fc9ac82def577ee578345d4f24e043e9415661bbc799.exe
-
Size
3.7MB
-
MD5
6b042ecf7c29ad15534621096520cab6
-
SHA1
a0e7ae80322f62f7fb7c13daf17fa7f4bf2fa401
-
SHA256
7971881855b6c6c2ac99fc9ac82def577ee578345d4f24e043e9415661bbc799
-
SHA512
b63817abac66a103cdc10149b2ff62a63a8ec86325e8d2b19936fa375292156a5899298e857cbd4dd4b811ee81ce70383087c26a31b222b51d6cb230fe25cc02
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98o:U6XLq/qPPslzKx/dJg1ErmNl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2520-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1656-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-66-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2924-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-85-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2676-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-125-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1940-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-146-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2948-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/656-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/752-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/832-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/304-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/612-234-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2480-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-260-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1944-272-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1944-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1740-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-435-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/2180-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2040-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-478-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3036-504-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-609-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-618-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1608-616-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1620-624-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2012-699-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 2544 rllrfff.exe 3068 1bnntt.exe 1656 9pvdp.exe 2332 5nnbht.exe 2896 7vvdj.exe 2292 3xrflfl.exe 2872 pjdjv.exe 2924 tbnbht.exe 2676 1jddv.exe 1872 7tthnt.exe 2852 5btbhn.exe 1688 fflfxlx.exe 1732 tbbnbb.exe 1940 ppvvp.exe 2844 9jvdp.exe 2948 xxrxrxf.exe 2028 ddddj.exe 1772 3jddj.exe 2268 rfrxflr.exe 656 xxlxfxl.exe 752 rrlrflr.exe 2092 bhbnnt.exe 832 btnbth.exe 304 nbtnbn.exe 612 xllrllx.exe 1544 vjpjp.exe 1648 3tntbt.exe 2480 7ttbtt.exe 1944 xfrxlrx.exe 2168 lxxxlrf.exe 2156 jjddp.exe 1808 xrlxfrx.exe 3060 fxrfrlr.exe 1400 vvvpd.exe 1740 nhtbnn.exe 544 7nhhth.exe 2364 rrrfllr.exe 2772 ffxllxl.exe 2332 dvppp.exe 3028 dvpdv.exe 2792 9bntnb.exe 2236 bnbntt.exe 2160 xlfflrf.exe 2924 lfxrffr.exe 2652 vdddv.exe 2376 pjppv.exe 1536 nhthbh.exe 2860 fxrrflx.exe 1688 jjvdd.exe 1948 jjjvd.exe 2400 3nbhbh.exe 2876 5nhtht.exe 2180 3lxfrxl.exe 1048 rrrxlrf.exe 2040 jjjvv.exe 2088 5vjjp.exe 1728 5htnnt.exe 2120 lllfxxr.exe 1488 9lrffrr.exe 348 7ddvv.exe 1684 vvvjp.exe 3036 nnhnbb.exe 2816 xlxfrfr.exe 2992 1xllrrr.exe -
resource yara_rule behavioral1/memory/2520-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2544-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012116-7.dat upx behavioral1/files/0x000800000001747b-16.dat upx behavioral1/memory/2544-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001748f-27.dat upx behavioral1/memory/1656-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001752f-36.dat upx behavioral1/files/0x00080000000173fb-44.dat upx behavioral1/memory/2896-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2292-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000018678-54.dat upx behavioral1/files/0x0006000000018690-62.dat upx behavioral1/memory/2872-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001879b-72.dat upx behavioral1/memory/2872-66-0x0000000000230000-0x0000000000257000-memory.dmp upx behavioral1/files/0x00080000000190d6-81.dat upx behavioral1/memory/2924-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000193cc-92.dat upx behavioral1/memory/2676-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193d9-99.dat upx behavioral1/memory/2852-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193df-108.dat upx behavioral1/memory/2852-107-0x00000000003C0000-0x00000000003E7000-memory.dmp upx behavioral1/memory/1688-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019401-118.dat upx behavioral1/files/0x0005000000019403-126.dat upx behavioral1/files/0x000500000001942f-137.dat upx behavioral1/memory/1940-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2844-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019441-145.dat upx behavioral1/files/0x000500000001947e-155.dat upx behavioral1/memory/2948-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2028-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194d8-165.dat upx behavioral1/memory/2268-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019539-173.dat upx behavioral1/memory/2268-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/656-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195e4-183.dat upx behavioral1/files/0x000500000001961b-192.dat upx behavioral1/memory/752-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961d-201.dat upx behavioral1/files/0x000500000001961f-209.dat upx behavioral1/memory/832-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019620-218.dat upx behavioral1/files/0x0005000000019621-227.dat upx behavioral1/memory/304-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/612-234-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019623-237.dat upx behavioral1/files/0x0005000000019625-246.dat upx behavioral1/memory/2480-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019627-256.dat upx behavioral1/memory/1648-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019629-265.dat upx behavioral1/files/0x0005000000019639-273.dat upx behavioral1/memory/1944-275-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001967d-283.dat upx behavioral1/files/0x00050000000196be-291.dat upx behavioral1/memory/3060-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1740-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1740-319-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/544-320-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2364-328-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lflllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfrlrl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2544 2520 7971881855b6c6c2ac99fc9ac82def577ee578345d4f24e043e9415661bbc799.exe 30 PID 2520 wrote to memory of 2544 2520 7971881855b6c6c2ac99fc9ac82def577ee578345d4f24e043e9415661bbc799.exe 30 PID 2520 wrote to memory of 2544 2520 7971881855b6c6c2ac99fc9ac82def577ee578345d4f24e043e9415661bbc799.exe 30 PID 2520 wrote to memory of 2544 2520 7971881855b6c6c2ac99fc9ac82def577ee578345d4f24e043e9415661bbc799.exe 30 PID 2544 wrote to memory of 3068 2544 rllrfff.exe 31 PID 2544 wrote to memory of 3068 2544 rllrfff.exe 31 PID 2544 wrote to memory of 3068 2544 rllrfff.exe 31 PID 2544 wrote to memory of 3068 2544 rllrfff.exe 31 PID 3068 wrote to memory of 1656 3068 1bnntt.exe 32 PID 3068 wrote to memory of 1656 3068 1bnntt.exe 32 PID 3068 wrote to memory of 1656 3068 1bnntt.exe 32 PID 3068 wrote to memory of 1656 3068 1bnntt.exe 32 PID 1656 wrote to memory of 2332 1656 9pvdp.exe 33 PID 1656 wrote to memory of 2332 1656 9pvdp.exe 33 PID 1656 wrote to memory of 2332 1656 9pvdp.exe 33 PID 1656 wrote to memory of 2332 1656 9pvdp.exe 33 PID 2332 wrote to memory of 2896 2332 5nnbht.exe 34 PID 2332 wrote to memory of 2896 2332 5nnbht.exe 34 PID 2332 wrote to memory of 2896 2332 5nnbht.exe 34 PID 2332 wrote to memory of 2896 2332 5nnbht.exe 34 PID 2896 wrote to memory of 2292 2896 7vvdj.exe 35 PID 2896 wrote to memory of 2292 2896 7vvdj.exe 35 PID 2896 wrote to memory of 2292 2896 7vvdj.exe 35 PID 2896 wrote to memory of 2292 2896 7vvdj.exe 35 PID 2292 wrote to memory of 2872 2292 3xrflfl.exe 36 PID 2292 wrote to memory of 2872 2292 3xrflfl.exe 36 PID 2292 wrote to memory of 2872 2292 3xrflfl.exe 36 PID 2292 wrote to memory of 2872 2292 3xrflfl.exe 36 PID 2872 wrote to memory of 2924 2872 pjdjv.exe 37 PID 2872 wrote to memory of 2924 2872 pjdjv.exe 37 PID 2872 wrote to memory of 2924 2872 pjdjv.exe 37 PID 2872 wrote to memory of 2924 2872 pjdjv.exe 37 PID 2924 wrote to memory of 2676 2924 tbnbht.exe 38 PID 2924 wrote to memory of 2676 2924 tbnbht.exe 38 PID 2924 wrote to memory of 2676 2924 tbnbht.exe 38 PID 2924 wrote to memory of 2676 2924 tbnbht.exe 38 PID 2676 wrote to memory of 1872 2676 1jddv.exe 39 PID 2676 wrote to memory of 1872 2676 1jddv.exe 39 PID 2676 wrote to memory of 1872 2676 1jddv.exe 39 PID 2676 wrote to memory of 1872 2676 1jddv.exe 39 PID 1872 wrote to memory of 2852 1872 7tthnt.exe 40 PID 1872 wrote to memory of 2852 1872 7tthnt.exe 40 PID 1872 wrote to memory of 2852 1872 7tthnt.exe 40 PID 1872 wrote to memory of 2852 1872 7tthnt.exe 40 PID 2852 wrote to memory of 1688 2852 5btbhn.exe 41 PID 2852 wrote to memory of 1688 2852 5btbhn.exe 41 PID 2852 wrote to memory of 1688 2852 5btbhn.exe 41 PID 2852 wrote to memory of 1688 2852 5btbhn.exe 41 PID 1688 wrote to memory of 1732 1688 fflfxlx.exe 42 PID 1688 wrote to memory of 1732 1688 fflfxlx.exe 42 PID 1688 wrote to memory of 1732 1688 fflfxlx.exe 42 PID 1688 wrote to memory of 1732 1688 fflfxlx.exe 42 PID 1732 wrote to memory of 1940 1732 tbbnbb.exe 43 PID 1732 wrote to memory of 1940 1732 tbbnbb.exe 43 PID 1732 wrote to memory of 1940 1732 tbbnbb.exe 43 PID 1732 wrote to memory of 1940 1732 tbbnbb.exe 43 PID 1940 wrote to memory of 2844 1940 ppvvp.exe 44 PID 1940 wrote to memory of 2844 1940 ppvvp.exe 44 PID 1940 wrote to memory of 2844 1940 ppvvp.exe 44 PID 1940 wrote to memory of 2844 1940 ppvvp.exe 44 PID 2844 wrote to memory of 2948 2844 9jvdp.exe 45 PID 2844 wrote to memory of 2948 2844 9jvdp.exe 45 PID 2844 wrote to memory of 2948 2844 9jvdp.exe 45 PID 2844 wrote to memory of 2948 2844 9jvdp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7971881855b6c6c2ac99fc9ac82def577ee578345d4f24e043e9415661bbc799.exe"C:\Users\Admin\AppData\Local\Temp\7971881855b6c6c2ac99fc9ac82def577ee578345d4f24e043e9415661bbc799.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\rllrfff.exec:\rllrfff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\1bnntt.exec:\1bnntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\9pvdp.exec:\9pvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\5nnbht.exec:\5nnbht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\7vvdj.exec:\7vvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\3xrflfl.exec:\3xrflfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\pjdjv.exec:\pjdjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\tbnbht.exec:\tbnbht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\1jddv.exec:\1jddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\7tthnt.exec:\7tthnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\5btbhn.exec:\5btbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\fflfxlx.exec:\fflfxlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\tbbnbb.exec:\tbbnbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\ppvvp.exec:\ppvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\9jvdp.exec:\9jvdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\xxrxrxf.exec:\xxrxrxf.exe17⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ddddj.exec:\ddddj.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2028 -
\??\c:\3jddj.exec:\3jddj.exe19⤵
- Executes dropped EXE
PID:1772 -
\??\c:\rfrxflr.exec:\rfrxflr.exe20⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xxlxfxl.exec:\xxlxfxl.exe21⤵
- Executes dropped EXE
PID:656 -
\??\c:\rrlrflr.exec:\rrlrflr.exe22⤵
- Executes dropped EXE
PID:752 -
\??\c:\bhbnnt.exec:\bhbnnt.exe23⤵
- Executes dropped EXE
PID:2092 -
\??\c:\btnbth.exec:\btnbth.exe24⤵
- Executes dropped EXE
PID:832 -
\??\c:\nbtnbn.exec:\nbtnbn.exe25⤵
- Executes dropped EXE
PID:304 -
\??\c:\xllrllx.exec:\xllrllx.exe26⤵
- Executes dropped EXE
PID:612 -
\??\c:\vjpjp.exec:\vjpjp.exe27⤵
- Executes dropped EXE
PID:1544 -
\??\c:\3tntbt.exec:\3tntbt.exe28⤵
- Executes dropped EXE
PID:1648 -
\??\c:\7ttbtt.exec:\7ttbtt.exe29⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xfrxlrx.exec:\xfrxlrx.exe30⤵
- Executes dropped EXE
PID:1944 -
\??\c:\lxxxlrf.exec:\lxxxlrf.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2168 -
\??\c:\jjddp.exec:\jjddp.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2156 -
\??\c:\xrlxfrx.exec:\xrlxfrx.exe33⤵
- Executes dropped EXE
PID:1808 -
\??\c:\fxrfrlr.exec:\fxrfrlr.exe34⤵
- Executes dropped EXE
PID:3060 -
\??\c:\vvvpd.exec:\vvvpd.exe35⤵
- Executes dropped EXE
PID:1400 -
\??\c:\nhtbnn.exec:\nhtbnn.exe36⤵
- Executes dropped EXE
PID:1740 -
\??\c:\7nhhth.exec:\7nhhth.exe37⤵
- Executes dropped EXE
PID:544 -
\??\c:\rrrfllr.exec:\rrrfllr.exe38⤵
- Executes dropped EXE
PID:2364 -
\??\c:\ffxllxl.exec:\ffxllxl.exe39⤵
- Executes dropped EXE
PID:2772 -
\??\c:\dvppp.exec:\dvppp.exe40⤵
- Executes dropped EXE
PID:2332 -
\??\c:\dvpdv.exec:\dvpdv.exe41⤵
- Executes dropped EXE
PID:3028 -
\??\c:\9bntnb.exec:\9bntnb.exe42⤵
- Executes dropped EXE
PID:2792 -
\??\c:\bnbntt.exec:\bnbntt.exe43⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xlfflrf.exec:\xlfflrf.exe44⤵
- Executes dropped EXE
PID:2160 -
\??\c:\lfxrffr.exec:\lfxrffr.exe45⤵
- Executes dropped EXE
PID:2924 -
\??\c:\vdddv.exec:\vdddv.exe46⤵
- Executes dropped EXE
PID:2652 -
\??\c:\pjppv.exec:\pjppv.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2376 -
\??\c:\nhthbh.exec:\nhthbh.exe48⤵
- Executes dropped EXE
PID:1536 -
\??\c:\fxrrflx.exec:\fxrrflx.exe49⤵
- Executes dropped EXE
PID:2860 -
\??\c:\jjvdd.exec:\jjvdd.exe50⤵
- Executes dropped EXE
PID:1688 -
\??\c:\jjjvd.exec:\jjjvd.exe51⤵
- Executes dropped EXE
PID:1948 -
\??\c:\3nbhbh.exec:\3nbhbh.exe52⤵
- Executes dropped EXE
PID:2400 -
\??\c:\5nhtht.exec:\5nhtht.exe53⤵
- Executes dropped EXE
PID:2876 -
\??\c:\3lxfrxl.exec:\3lxfrxl.exe54⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rrrxlrf.exec:\rrrxlrf.exe55⤵
- Executes dropped EXE
PID:1048 -
\??\c:\jjjvv.exec:\jjjvv.exe56⤵
- Executes dropped EXE
PID:2040 -
\??\c:\5vjjp.exec:\5vjjp.exe57⤵
- Executes dropped EXE
PID:2088 -
\??\c:\5htnnt.exec:\5htnnt.exe58⤵
- Executes dropped EXE
PID:1728 -
\??\c:\lllfxxr.exec:\lllfxxr.exe59⤵
- Executes dropped EXE
PID:2120 -
\??\c:\9lrffrr.exec:\9lrffrr.exe60⤵
- Executes dropped EXE
PID:1488 -
\??\c:\7ddvv.exec:\7ddvv.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:348 -
\??\c:\vvvjp.exec:\vvvjp.exe62⤵
- Executes dropped EXE
PID:1684 -
\??\c:\nnhnbb.exec:\nnhnbb.exe63⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xlxfrfr.exec:\xlxfrfr.exe64⤵
- Executes dropped EXE
PID:2816 -
\??\c:\1xllrrr.exec:\1xllrrr.exe65⤵
- Executes dropped EXE
PID:2992 -
\??\c:\7dpdp.exec:\7dpdp.exe66⤵PID:1692
-
\??\c:\3jvdj.exec:\3jvdj.exe67⤵PID:1780
-
\??\c:\bthnbh.exec:\bthnbh.exe68⤵PID:1764
-
\??\c:\xrlrxff.exec:\xrlrxff.exe69⤵PID:2224
-
\??\c:\ddvpj.exec:\ddvpj.exe70⤵PID:1744
-
\??\c:\pjvvj.exec:\pjvvj.exe71⤵PID:2480
-
\??\c:\7hnthn.exec:\7hnthn.exe72⤵PID:2424
-
\??\c:\tbthnb.exec:\tbthnb.exe73⤵PID:1280
-
\??\c:\rxxlxlf.exec:\rxxlxlf.exe74⤵PID:888
-
\??\c:\dvpdp.exec:\dvpdp.exe75⤵PID:860
-
\??\c:\jjvjd.exec:\jjvjd.exe76⤵PID:3024
-
\??\c:\hhhbbt.exec:\hhhbbt.exe77⤵PID:1608
-
\??\c:\rrxrxrx.exec:\rrxrxrx.exe78⤵PID:1736
-
\??\c:\llffrrl.exec:\llffrrl.exe79⤵PID:2608
-
\??\c:\jvpjd.exec:\jvpjd.exe80⤵PID:3008
-
\??\c:\pdjjv.exec:\pdjjv.exe81⤵PID:1620
-
\??\c:\7btntb.exec:\7btntb.exe82⤵PID:2884
-
\??\c:\9nbhtb.exec:\9nbhtb.exe83⤵PID:2748
-
\??\c:\xxlrxll.exec:\xxlrxll.exe84⤵PID:2660
-
\??\c:\jvppj.exec:\jvppj.exe85⤵PID:2872
-
\??\c:\bbnthh.exec:\bbnthh.exe86⤵PID:2680
-
\??\c:\nhbbhb.exec:\nhbbhb.exe87⤵PID:1924
-
\??\c:\rrxrxfx.exec:\rrxrxfx.exe88⤵PID:2516
-
\??\c:\5vvjp.exec:\5vvjp.exe89⤵PID:552
-
\??\c:\jpdjj.exec:\jpdjj.exe90⤵PID:1812
-
\??\c:\5thhtt.exec:\5thhtt.exe91⤵PID:2836
-
\??\c:\nnhtbb.exec:\nnhtbb.exe92⤵PID:1984
-
\??\c:\lfflxfx.exec:\lfflxfx.exe93⤵
- System Location Discovery: System Language Discovery
PID:2012 -
\??\c:\7vjvj.exec:\7vjvj.exe94⤵PID:1948
-
\??\c:\pdpjv.exec:\pdpjv.exe95⤵PID:2732
-
\??\c:\tnthnb.exec:\tnthnb.exe96⤵PID:2868
-
\??\c:\xrxfrrf.exec:\xrxfrrf.exe97⤵PID:2180
-
\??\c:\lfffllx.exec:\lfffllx.exe98⤵PID:1048
-
\??\c:\pdpjp.exec:\pdpjp.exe99⤵PID:2124
-
\??\c:\btnthn.exec:\btnthn.exe100⤵PID:1148
-
\??\c:\lfxflrx.exec:\lfxflrx.exe101⤵PID:1500
-
\??\c:\lfflxfr.exec:\lfflxfr.exe102⤵PID:1868
-
\??\c:\dvpvd.exec:\dvpvd.exe103⤵PID:948
-
\??\c:\1ddjp.exec:\1ddjp.exe104⤵PID:752
-
\??\c:\nnhnnt.exec:\nnhnnt.exe105⤵PID:1556
-
\??\c:\bbbhht.exec:\bbbhht.exe106⤵PID:1684
-
\??\c:\rrrflxr.exec:\rrrflxr.exe107⤵PID:3036
-
\??\c:\9djpv.exec:\9djpv.exe108⤵PID:1096
-
\??\c:\pjpvv.exec:\pjpvv.exe109⤵PID:1804
-
\??\c:\hhbnbb.exec:\hhbnbb.exe110⤵PID:1876
-
\??\c:\9nhthn.exec:\9nhthn.exe111⤵PID:2612
-
\??\c:\llffxfr.exec:\llffxfr.exe112⤵
- System Location Discovery: System Language Discovery
PID:1648 -
\??\c:\ffrrfrl.exec:\ffrrfrl.exe113⤵PID:488
-
\??\c:\dvjpj.exec:\dvjpj.exe114⤵PID:2460
-
\??\c:\9hbbtb.exec:\9hbbtb.exe115⤵PID:592
-
\??\c:\bnbhnh.exec:\bnbhnh.exe116⤵PID:2356
-
\??\c:\rrrfxlf.exec:\rrrfxlf.exe117⤵PID:768
-
\??\c:\rllxlrr.exec:\rllxlrr.exe118⤵PID:792
-
\??\c:\vppvj.exec:\vppvj.exe119⤵PID:2256
-
\??\c:\bthntb.exec:\bthntb.exe120⤵
- System Location Discovery: System Language Discovery
PID:1616 -
\??\c:\nhttbh.exec:\nhttbh.exe121⤵PID:2436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-